Is it possible for my ISP to see the passwords that I enter on websites and in chat programs? And what about SSL websites that start with https, do they encrypt my username and password before reaching the ISP?

  • 3
    Is it possible? Yes for non SSL stuff (which isn't foolproof, but I'm trying to keep this short and practical). Is it likely? Not so much.
    – Rob Moir
    Jan 11, 2011 at 22:35
  • 1
    Related: Can my ISP monitor me?
    – Arjan
    Jan 13, 2011 at 13:19

5 Answers 5


If you start at an https:// address, everything is encrypted between your computer and the remote server, so your ISP can't intercept any of your data*. Your ISP could easily view any non-ssl (http://) connections though.

Note that the firesheep firefox plugin exposed a hole in this mechanism last year. Many websites use https just for your initial login and then switch back to http for the rest of the traffic. In this case your ISP could intercept your traffic after you logged in. Someone else on your local network could also run the firesheep plugin and hijack your session with say facebook and impersonate you.

Most large websites are now transitioning to https all the time to fix this hole. It's not really something you need to worry about on your home network too much, but you should be aware of how this works.

Assuming you're not ignoring certificate warnings, and your computer/browser has not been compromised.

* It can also see the hostname you're requesting from a possibly shared host. Since TLS1.0 the hostname is transmitted in plaintext (SNI)

  • @Arjan - with that edit this answer is much better. Cheers.
    – Rory Alsop
    Jan 13, 2011 at 13:52
  • Also, should note that other protocols (i.e.: telnet) are cleartext-only. YMMV with chat protocols.
    – Iszi
    Jan 13, 2011 at 15:43
  • Yes the warning about chat programs is a good one, as they may use different protocols. Jan 13, 2011 at 21:53
  • @Iszi Nobody uses telnet, I assume? I only ever used such things for fun (sic). May 27, 2013 at 1:38
  • @CamiloMartin You'd be surprised. The first examples that come to mind are MUDs. I'm sure there's others.
    – Iszi
    May 28, 2013 at 15:21

I think you might wanna watch the following video from 27th Chaos Communication Congress (CCC):

"How the Internet sees you: demonstrating what activities most ISPs see you doing on the Internet"

  1. Info Page
  2. Video (embed) and mp4 to download
  3. Pdf of the speak

Philiph is right for "If you start at an https:// address, everything is encrypted between your computer and the remote server" with one caveat: all you know with HTTPS is that everything is encrypted between your computer and somewhere else.

There is a risk that your communications could be tampered with at the ISP using a man in the middle attack — and if you think that that can't happen, see the news about Tunisia which shows what can happen if a malicious agent has access at ISP level.

This can only be avoided if:

  • A user always uses the correct https:// URL.
  • A user does not ignore certificate warnings.
  • The user is 100% sure their computer has not been tampered with.

Otherwise, an ISP could tamper with the connection in a way a non-tech savvy user may not notice.

  • Okay, cleaning up then. (What about using the Markdown source for better formatting and linking?)
    – Arjan
    Jan 13, 2011 at 15:19
  • 1
    I deleted some comments, now orphaning @weeheavy's comment a bit, in which "wrong" was directed towards me, not towards the answer: those appliances can only work in corporate environments, where the browser has been set up to accept fake certificates.
    – Arjan
    Jan 13, 2011 at 15:22

Sure, your ISP (or someone else using their equipment without permission, which is a serious risk in and of itself) could read unencrypted data that goes through their network. Typically, unencrypted traffic includes e-mail, web, and FTP traffic unless specifically encrypted using SSL or TLS, as in the HTTPS protocol.

Also typically, your ISP would prefer that at the very least, the passwords you send over the internet (in particular, for their e-mail accounts) are encrypted, so as to prevent attackers from compromising a router somewhere - like your wireless router with the default password - and gaining access to their servers. While the government could force an ISP to listen to your traffic for their purposes, a much greater threat to you exists from people who would love to steal your private information and/or money.

  • Does TLS block the case whereby "government could force an ISP" to hack you?
    – Pacerier
    Dec 28, 2016 at 14:44

Not directly an answer to your question, but passwords are more often stolen using either a keylogger (software illicitly installed on your PC that records all your keystrokes) or social engineering, such as phishing. (Phishing is sending email that tricks you into logging into a "fake version" of Facebook or whatever, thus revealing your password to the phishers, and then redirecting you to the real one. Most victims don't even realize at first what has happened.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .